13597 matches found
CVE-2014-8704
Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme...
CVE-2014-8704: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme...
CVE-2017-6370: Cleartext Transmission of Sensitive Information
TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields...
PT-2017-6702
Name of the Vulnerable Software and Affected Versions qdPM version 8.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including the searchkeywords parameter to "index.php/users" page, the "Name of application" on...
PT-2017-6261
Name of the Vulnerable Software and Affected Versions Wonder CMS version 2014 Description A directory traversal issue in index.php allows remote attackers to include and execute arbitrary local files by crafting a theme. Recommendations For Wonder CMS version 2014, consider restricting access to...
CVE-2015-3883: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the 1 searchkeywords parameter to index.php/users page; the 2 "Name of application" on index.php/configuration; 3 a new project name on index.php/projects; 4 the task na...
PT-2017-6701
Name of the Vulnerable Software and Affected Versions qdPM version 8.3 Description The issue allows remote attackers to obtain sensitive information. This is achieved by providing an invalid ID value to the "index.php/users/info/id/ID" endpoint, which results in an error message that reveals the...
PT-2017-17023
Name of the Vulnerable Software and Affected Versions TYPO3 version 7.6.15 Description The issue allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields. This occurs when TYPO3 sends an HTTP request to an...
CVE-2015-3882: Exposure of Sensitive Information to an Unauthorized Actor
qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/ID, which reveals the installation path in an error message...
CVE-2017-6907
An issue was discovered in Open.GL before 2017-03-13. The vulnerability exists due to insufficient filtration of user-supplied data content passed to the "Open.GL-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website...
CVE-2017-6909
An issue was discovered in Shimmie = 2.5.1. The vulnerability exists due to insufficient filtration of user-supplied data log passed to the "shimmie2-master/ext/chatbox/history/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable...
CVE-2017-6909: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Shimmie = 2.5.1. The vulnerability exists due to insufficient filtration of user-supplied data log passed to the "shimmie2-master/ext/chatbox/history/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable...
PT-2017-17409
Name of the Vulnerable Software and Affected Versions Shimmie versions prior to 2.5.1 Description The issue is caused by insufficient filtration of user-supplied data passed to the "shimmie2-master/ext/chatbox/history/index.php" URL, allowing an attacker to execute arbitrary HTML and script code ...
CVE-2017-6907: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Open.GL before 2017-03-13. The vulnerability exists due to insufficient filtration of user-supplied data content passed to the "Open.GL-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website...
PT-2017-17407
Name of the Vulnerable Software and Affected Versions Open.GL versions prior to 2017-03-13 Description The issue exists due to insufficient filtration of user-supplied data passed to the "Open.GL-master/index.php" URL. This allows an attacker to execute arbitrary HTML and script code in a browser...
Joomla Simple Membership 3.3.3 SQL Injection
Exploit Title: Joomla! Component Simple Membership v3.3.3 - SQL Injection Google Dork: inurl:index.php?option=comsimplemembership Date: 14.03.2017 Vendor Homepage: http://ordasoft.com/ Software :...
Cross site scripting
XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=object&action=XSS attack...
Cross site scripting
XSS in Agora-Project 3.2.2 exists with an index.php?disconnect=1&msgNotif=XSS attack...
